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MONETARY PENALTY NOTICE 


Home2sense Limited 


Ardeifi, 

New Street, 
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SA48 7AL 


The Information Commissioner (“the Commissioner”) has decided to 
issue Home2sense Limited (“Home2sense”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is in relation to a serious contravention of regulations 21 and 24 of the 
Privacy and Electronic Communications (EC Directive) Regulations 2003 
(“PECR"). 


This notice explains the Commissioner's decision. 


Legal framework 


Home2sense, whose registered office is given above (Companies House 
Registration Number: 12219714) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 
(“TPS”), then that individual must have notified the company that they 


do not object to receiving such calls from it. 
Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 
7. Regulation 24 of PECR provides: 


"(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 21 
[or 21A] (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 
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(2) The particulars referred to in paragraph (1) are - 


(a) the name of the person; 


(b) either the address of the person or a telephone 


number on which he can be reached free of charge.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company which operates the 
register on the Commissioner’s behalf. Businesses who wish to carry 
out direct marketing by telephone can subscribe to the TPS for a fee 


and receive from them monthly a list of numbers on that register. 


Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of 
the DPA18). 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals". 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 
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"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that —- 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 


contravention. 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 
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Background to the case 


Home2sense first came to the attention of the Commissioner upon 
analysing complaint trends which indicated an increase in unsolicited 
calls regarding loft insulation. The complaints indicated that various 
trading styles had been used on the calls, such as Cozy Loft, Warmer 
Homes and Comfier Homes. In order to identify the organisation 
responsible for these calls the Commissioner issued a third-party 
information notice (“3PIN”) on 16 April 2021 to the relevant 
Communications Service Provider (“CSP”) asking for information 
regarding the subscriber for six particular calling line identifiers 


(“CLIs”) from which the calls had originated. 


The CSP responded, stating that the CLIs were allocated to a particular 
individual, and provided their contact details together with a 
spreadsheet listing a total of 70 CLIs assigned to him. The CSP stated 


that the CLIs were only used for incoming traffic. 


A search was conducted on the email address provided by the CSP 
against the Commissioner’s register, producing a result for 
Home2sense, whose ‘main contact’ matched the name of the individual 
given by the CSP; this individual was also identified as a director for 


Home2sense. 


The Commissioner made further enquiries with the CSP explaining that 
the lines used by Home2sense did not appear restricted to incoming 
traffic, as there had been complaints about outbound calls from the 
CLIs. In response, the CSP explained that Home2sense was most likely 
using a third-party termination provider to make the outbound calls, 
using the CLIs which had been assigned by the CSP. The CSP liaised 
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separately with Home2sense which confirmed that it was indeed using 
the CLIs. Home2sense advised the CSP that it is: “... a company who 
call homeowners in regards to previous work that has been done to 


carry out complimentary checks for homeowners leaving them on 


information with energy saving solutions” [sic]. 


On 13 May 2021 an initial investigation letter along with a spreadsheet 
of complaints was sent to Home2sense. The letter outlined Regulation 
21 and 24 of PECR, the Commissioner’s powers, and requested 
evidence that the individuals which it called, who were registered on 
the TPS, had notified Home2sense that they did not object to its calls 


(i.e. that they had consented to receive direct marketing calls). 


On 21 May 2021, Home2sense provided documentation to the 
Commissioner authorising its Accountant to act on its behalf as a 
representative (the “Representative”). 


Following a request from Home2sense, on 3 June 2021 the 
Commissioner granted an extension to the deadline for a substantive 
response which had been stipulated within the initial investigation 
letter. The Commissioner advised that a substantive response was now 


expected from the Representative by 14 June 2021. 


On 21 June 2021, having received no response from the 
Representative, the Commissioner sent a chaser email, which the 
Representative acknowledged stating that a response would be 
provided that day. Nothing was received, and a further chaser was sent 
on 28 June 2021. 


On 6 July 2021, with a response to the Commissioner’s initial questions 


still having not been received, the Commissioner sent a further chaser. 
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A partial response was received the following day (7 July 2021), 
providing a brief explanation about Home2sense’s direct marketing 


procedures, along with a list of trading names and details of the service 


provider supplying the outbound calls. 


The response failed to include evidence of notification for the purposes 
of regulation 21(4), evidence of due diligence for its data suppliers or 
details of the volumes of calls made. Furthermore, the Representative 
advised that the “data [which it used to make the calls] was acquired 
from an unknown source”. In response to the questions regarding TPS 
screening, it stated: “Our telecalls staff are instructed to do so but as is 
the case within this industry a high staff turnover is experienced. The 
company does thoroughly train staff, but it is physically beyond the 
control of management to ensure staff do use the TPS Register. The 
staff are instructed that no unsolicited calls should be made but until 
we can establish the quality of staff errors may occur”. 


The Representative failed to provide any written procedures or policies 
for screening data against the TPS, or the organisation’s suppression 
list. Instead, it provided a brief explanation stating that checks were 
conducted against an excel spreadsheet on a bi-weekly basis. In 
addition, the Representative explained that, in its view, the volume of 
complaints “were relatively low for a call centre”, suggesting that the 
“erroneous Calls [...] are either made by staff in the initial training 
process or have been made by staff who have been dismissed once the 
errors have come to light”. It suggested that “there will be mistakes 
and it’s not possible to reduce this to zero”. The Representative also 
sought to suggest that PECR did not apply to the calls being made by 
Home2sense, stating that “/a/s no electronic marketing messages are 


transmitted we would suggest that PECR is not applicable”. 
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Noting that earlier in the investigation the CSP had advised the 
Commissioner that Home2sense appeared to be using a third party to 
make its outbound calls, the Commissioner subsequently sought to 
contact trading a 
D. whom Home2sense’s Representative had identified in its 
response of 7 July 2021. The Commissioner served EEE with a 
3PIN in an effort to obtain the call dialler records (“CDRs”) for calls 


made from CLIs attributable to Home2sense for a prescribed period. 


i. response provided CDRs for the CLIs which were 
recognised as being allocated to Home2sense between 23 June 2020 


and 31 March 2021. The CLIs used tallied with those disclosed by the 


CSP at the outset of the Commissioner’s investigation. 


The CDRs were screened against the TPS register by the Commissioner 
and analysed internally to determine how many of the calls had been 
made to subscribers who had been registered with the TPS for not less 
than 28 days; it was established that Home2sense had made a total of 
798,489 calls, of which 675,478 were to numbers which had been 
registered with the TPS for not less than 28 days. 


On 26 July 2021 the Commissioner sent an email to the Representative 
requesting an update on the information not previously supplied, 
specifically evidence of notification from the subscribers which 
Home2sense had called, evidence of call volumes, and relevant 
policies, procedures, and due diligence checks. The correspondence 
requested the information be supplied within 7 days; however this 
deadline passed without receiving the information or an update from 


the Representative. 
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On 4 August 2021, an email was sent to the Representative requesting 
an update as a matter of urgency, but again no response was received. 
As such, an email was sent to the Representative on 12 August 2021 
expressing concern that relevant information requested in the 
Commissioner's initial letter of 13 May 2021 was yet to be provided. 
Noting the lack of engagement up to this point, the email stated that 
the Commissioner would now consider whether formal enforcement 


action was appropriate. 


The Commissioner has considered the complaints made both to the TPS 
and to the Commissioner directly in relation to unsolicited calls from 
CLIs attributed to Home2sense and has discovered that between 23 
June 2020 and 30 March 2021 there were a total of 62 complaints 
made, with a further 7 complaints being made in April 2021. 


The complaints included the following: 


e “Asked to speak to Mrs [Redacted] who happens to be my late 
mother who passed away over 10 years ago as the loft insulation 
needs to be surveyed as it may cause problems. They called 3 
times. This was distressing as they were asking to speak to my 
late mother. Surely being on the TPS register should stop these 


calls and they need to be prosecuted.” 


e “Said they were a local surveyor and said I'd had loft insulation 
replaced a long time ago. Also said I might be eligible for a free 
grant to replace it again. They knew my name, my address and 
my telephone number. This is my recently deceased mother's 
house that I have just inherited in the last few months. It was 


extremely upsetting to have someone deliberately cold-call me. 
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They said it was not illegal to phone someone on the TPS list and 


they couldn't be fined for doing this.” 


“The woman stated twice that this was not sales or marketing 
but told me that I was on their renewable energy database as we 
had had roof insulation fitted between 5 and 35 years ago. They 
wanted to check for mould and then lepolar [sic] would give their 
estimate. We have been here for many years and do our own 


work on the home, so this was untrue.” 


“Trying to get me to buy wall insulation. They used a local 
number, but I can see they are actually based in Cardiff. I told 


her I was registered with TPS, and she said it wasn't relevant.” 


“Agent calling wasn't sure which area they were calling, and 
would only give details for cozylofts.co.uk, refused to provide 
company details. Assured me I was on the "renewable energy 
database” which I "can not opt out of” and is created "when 
people buy other products and give any details” like BEEE 1 
pointed out this was a breach of cold-calling and I had not given 
any details, there is no such database, and I did not consent. A 
supervisor "Stacey” said the company was "Lapolla” and that I 
"would be taken off the list" but did not do so because she hung 


up before taking any details.” 


“They were in our area asking about our loft insulation. Wouldn't 


take no for an answer so I hung up and blocked their number.” 


"A cold call offering a free survey of our roof insulation. Hard sell 


and harassing. We have been registered with TPS for many years 
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but, although the number of nuisance calls has reduced, there 


are still too many unsolicited sales calls.” 


The Commissioner is satisfied that the 675,478 calls transmitted by 
Home2sense were all clearly made for the purposes of direct marketing 
as defined by section 122(5) DPA18. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulations 21 and 24 of PECR by Home2sense and, if 


so, whether the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that Home2sense contravened regulations 21 
and 24 of PECR. 


The Commissioner finds that the contravention was as follows: 


Between 23 June 2020 and 31 March 2021, Home2sense used a public 
telecommunications service for the purposes of making 675,478 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
This resulted in 29 complaints being made to the TPS, with a further 33 


being made to the Commissioner. 
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The Commissioner is also satisfied for the purposes of regulation 21 
that these 675,478 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and who for the purposes of regulation 21(4) had 


not notified Home2sense that they did not object to receiving such 


calls. 


For such notification to be valid under regulation 21(4), the individual 
must have taken a clear and positive action to override their TPS 
registration and indicate their willingness to receive marketing calls 
from the company. The notification should reflect the individual’s 
choice about whether or not they are willing to receive marketing calls. 
Therefore, where signing up to use a product or service is conditional 
upon receiving marketing calls, companies will need to demonstrate 
how this constitutes a clear and positive notification of the individual’s 


willingness to receive such calls. 


The notification must clearly indicate the individual’s willingness to 
receive marketing calls specifically. Companies cannot rely on 
individuals opting in to marketing communications generally, unless it 


is clear that this will include telephone calls. 


Further, the notification must demonstrate the individual’s willingness 
to receive marketing calls from that company specifically. Notifications 
will not be valid for the purposes of regulation 21(4) if individuals are 

asked to agree to receive marketing calls from “similar organisations”, 


wm 


“partners”, “selected third parties” or other similar generic descriptions. 


Indeed, the extent to which Home2sense gave any attention to its 
legislative duties, not least in respect of regulation 21, is impossible to 


establish; Home2sense has failed to substantively engage with the 


13 


45. 


© 

ICO. 

Information Commissioner's Office 
Commissioner’s investigation, save for a brief and incomplete response 
on 7 July 2021 which itself followed a series of chaser correspondence 
from the Commissioner. At this time, Home2sense’s appointed 
Representative stated that in response to the Commissioner’s query for 
the source of the data used in its campaigns simply that “data was 
acquired from an unknown source”, having confirmed that no data is 
obtained from customers directly. The Commissioner would submit that 
it is simply inconceivable that Home2sense would be unable to confirm 
who its third-party data providers were, and the Commissioner can 
view this refusal to provide the information only as an attempt to 
obstruct his investigation. Home2sense’s dismissive and troubling 
response, coupled with its failure to disclose any details of its CDRs or 
any other information which might assist the Commissioner’s 
investigation shows, in the Commissioner's view, a complete disregard 
for the privacy rights of the individuals whom it sought to contact. 
Going further, it seems reasonable to believe that Home2sense in fact 
gave no regard to its legislative duties regarding its direct marketing 
practices, given its suggestion on 7 July 2021 that PECR “would not be 


applicable” to its campaign. 


The Commissioner is also concerned by Home2sense’s attempts to 
deflect responsibility for compliance with the law on to its staff, 
indicating that it was beyond its control to ensure staff screened data 
against the TPS register prior to making calls. Home2sense’s appointed 
Representative failed to provide any evidence that any such TPS checks 
were actually carried out. It also failed to provide any training 
materials used for its staff so the Commissioner is unable to determine 
the efficacy of those, or even whether they actually exist. In any event, 
responsibility for compliance with the legislation rests on the 
organisation itself. The organisation should have implemented robust 


procedures to ensure that data which it purchased was either screened 
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against the TPS before it was given to call agents, or that it had 


obtained valid notification under regulation 21(4). 


Further, there is evidence from the complaints that Home2sense failed, 
as required by regulation 24 of PECR, to provide the recipient of the 
calls with the particulars specified at regulation 24(2) of PECR. In 
particular, when it did provide subscribers with the name of the caller, 
it used seemingly interchangeable trading styles which could not be 


readily identifiable as Home2sense. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulations 21 and 24 by Home2sense arising from the 
organisation’s activities between 23 June 2020 and 31 March 2021, and 
this led to 675,478 unsolicited direct marketing calls being made to 
subscribers who were registered with the TPS and who had not notified 
Home2sense that they were willing to receive such calls, and 62 


complaints being made as a result. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 
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The Commissioner considers that in this case Home2sense did 
deliberately contravene regulations 21 and 24 of PECR. The 
Commissioner notes Home2sense’s almost complete failure to engage 
with his investigation and its failure to provide any evidence to suggest 
it had taken any steps whatsoever to consider the privacy of the 
individuals who it sought to target. Home2sense’s failure to provide 
any such information suggests that no safeguards were implemented, 
and that Home2sense was more than simply negligent in its actions. 
Complaints indicate that Home2sense provided misleading names to 
recipients of their calls, and approached some individuals with false 
representations, i.e. by claiming their names existed on a renewable 
energy database. Complaints also suggest that Home2sense was 
obstructive and unhelpful when individuals asked for their details to be 


removed from its call dialler list. 


For the above reasons, the Commissioner is satisfied that this breach 


was deliberate 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, he has considered whether Home2sense knew or ought 
reasonably to have known that there was a risk that this contravention 
would occur. This is not a high bar and he is satisfied that this 


condition is met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 


This guidance explains the circumstances under which organisations 
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are able to carry out marketing over the phone, by text, by email, by 

post or by fax. Specifically, it states that live calls must not be made to 

any subscriber registered with the TPS, unless the subscriber has 

specifically notified the company that they do not object to receiving 

such calls. In case organisations remain unclear on their obligations, 

the ICO operates a telephone helpline. ICO communications about 

previous enforcement action where businesses have not complied with 


PECR are also readily available. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that Home2sense would have received a notification from 
the TPS for each of the complaints being made in this case. That there 
were 29 complaints made to the TPS alone over the period of the 
contravention should have made Home2sense aware of the risk that 


such contraventions may occur and were indeed occurring. 


It is therefore reasonable to suppose that Home2sense should have 


been aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether 
Home2sense failed to take reasonable steps to prevent the 


contravention. Again, he is satisfied that this condition is met. 


Home2sense confirmed during the investigation that it did not obtain 
data from individuals directly, and relied wholly on data purchased 
from third parties, although concerningly it failed to disclose details of 
its third-party data providers or the sources of the data it used. The 
Commissioner’s direct marketing guidance makes clear that 
organisations utilising marketing lists from a third party must 


undertake rigorous checks to satisfy themselves that the personal data 
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was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary notifications for the 
purposes of regulation 21(4). It would not be acceptable to rely on 
assurances given by third party suppliers without undertaking proper 
due diligence. The Commissioner is highly concerned by Home2sense’s 
failure to engage with the Commissioner's request for information 
about its third-party data providers, and can infer from that only that 


no due diligence into the veracity of the data was carried out. 


Reasonable steps in these circumstances may have included ensuring 
that it accurately recorded the source of the data it relied upon for its 
direct marketing campaign, together with evidence that the individuals 
had either provided valid notification under regulation 21(4), or were 
not registered with the TPS. Home2sense could have carried out TPS 
checks and maintained records to evidence such checks should it be 
required to do so. Furthermore, Home2sense should reasonably have 
had in place appropriate policies and procedures for staff in respect of 
its marketing; instead it adopted what can only be interpreted as a lax 
approach to its statutory obligations, with inadequate (and possibly 


non-existent) TPS screening processes. 


Given the volume of calls and complaints, it is clear that Home2sense 


failed to take any reasonable steps to prevent the contravention. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 
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The Commissioner has taken into account the following aggravating 


features of this case: 


Complaints evidence shows the calls were of a persistent nature and 
they are known to have caused distress, i.e. there were two recorded 
instances where Home2sense asked to speak to a named person whose 


relatives confirmed had passed away. 


The Commissioner is satisfied that Home2sense carried out these calls, 
in the knowledge that its actions were likely to be in breach of PECR, 
with the intention of generating business to ultimately make a financial 


profit. 


Home2sense appointed a Representative upon first contact from the 
Commissioner, however that Representative was unreliable, dismissive, 


and uncooperative with the Commissioner’s investigation. 


There is evidence of complaints continuing to be received regarding 
Home2sense following the Commissioner’s initial contact, which 
demonstrates that despite the concerns raised by the Commissioner, it 


continued to operate unabated. 
The Commissioner finds there are no mitigating features of this case 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking and invited 
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representations from Home2sense. In reaching his final view, the 


Commissioner has received no representations from Home2sense. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has attempted to consider the likely impact of a 
monetary penalty on Home2sense but has been unable to do so given 
the lack of recent publicly available information. Home2sense was 
invited to provide financial representations in response to the Notice of 
Intent, but failed to do so. The Commissioner considers in the 
circumstances that a penalty remains the appropriate course of action. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 
telephoning consumers who are not registered with the TPS and/or 


specifically indicate that they do not object to receiving these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 
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Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £200,000 (two hundred thousand 
pounds) is reasonable and proportionate given the particular facts of 


the case and the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 3 March 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
2 March 2022 the Commissioner will reduce the monetary penalty by 
20% to £160,000 (one hundred and sixty thousand pounds). 

However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
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77. Information about appeals is set out in Annex 1. 


78. The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 

e all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 

e the period for appealing against the monetary penalty and any 


variation of it has expired. 


79. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 
Dated the 31% day of January 2022. 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state:- 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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